I run this command to generate a CSR and a new key with openssl:

openssl req -new -nodes -days 9000 -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/mycompany.com.csr -keyout /etc/ssl/private/mycompany.com.key

I can't figure out what command I can run to generate just the key and not the CSR?

  • Check the man page for openssl. req is PKCS#10 X.509 Certificate Signing Request (CSR) Management. That means that you can't use req to work with something other than CSRs. Depending on what you really want to do, commands like passwd, pkey or rand may fit the bill better. – user Jul 19 '13 at 18:07
  • Thanks, what I want to know is what will produce the exact same kind of key as the req above. I think it is something like openssl genrsa -out /etc/ssl/private/mycompany.com.key 2048, just not sure? – user12810 Jul 19 '13 at 18:10
  • @Michael sorry, I should point out that the req in the question does produce a key because of the -keyout - that might have not been clear enough in the question. – user12810 Jul 19 '13 at 18:17
  • Thanks for the post. I found many usefull commands to generate csr, key and self-signed crt on the fly with one command in non-interactive mode. Here is the link - sysadm.pp.ua/internet/pound-apache-nginx-ssl-setup.html ,maybe if would be usefull – user99144 Jan 13 '15 at 20:29
  • @aprogrammer - thanks for the link, the commands on that page are useful, but the rest of the page is in Russian. Here's the Google translated URL for that page: translate.google.com/…. – slm Jan 13 '15 at 22:48

Yes the genrsa switch is the key that's getting generated in the req command. To generate the key I believe you just need to run this command:

$ openssl genrsa -out clientkey.pem

I always reference this page titled: The Most Common OpenSSL Commands - SSL Shopper. You can see from the examples that the key for a CSR is RSA, you can even control it's length when using the req command through the rsa:2048 parameter.


  • Generate a new private key and Certificate Signing Request

    $ openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
  • Generate a certificate signing request (CSR) for an existing private key

    $ openssl req -out CSR.csr -key privateKey.key -new

In the above you'll notice the use of the privateKey.key from the previous step being used to create the CSR.


  • Thanks, just what I wanted to know. I had found that page and noticed that it didn't have a command to generate a standalone key, which I think is a bit odd, don't you? – user12810 Jul 19 '13 at 20:07
  • @JackDouglas - yes I usually use that page plus several others to "refresh" my memories on how openssl works 8-). I've been meaning to write them up on my blog, when I can find the time. – slm Jul 19 '13 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy